278 lines
8.8 KiB
HTML
278 lines
8.8 KiB
HTML
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||
|
|
<html>
|
||
|
|
<head>
|
||
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
|
||
|
|
<meta name="Copyright" content="Copyright (c) 2006 by IBM Corporation">
|
||
|
|
<title>Set Profile Handle (QWTSETP, QsySetToProfileHandle) API</title>
|
||
|
|
<!-- Begin Header Records ========================================== -->
|
||
|
|
<!-- All rights reserved. Licensed Materials Property of IBM -->
|
||
|
|
<!-- US Government Users Restricted Rights -->
|
||
|
|
<!-- Use, duplication or disclosure restricted by -->
|
||
|
|
<!-- GSA ADP Schedule Contract with IBM Corp. -->
|
||
|
|
<!-- Sec SCRIPT A converted by B2H R4.1 (346) (CMS) by V2KEA304 -->
|
||
|
|
<!-- at RCHVMW2 on 17 Feb 1999 at 11:05:09 -->
|
||
|
|
<!-- Edited by Kersten Jan 02 -->
|
||
|
|
<!--End Header Records -->
|
||
|
|
<link rel="stylesheet" type="text/css" href="../rzahg/ic.css">
|
||
|
|
</head>
|
||
|
|
<body>
|
||
|
|
<a name="Top_Of_Page"></a>
|
||
|
|
<!-- Java sync-link -->
|
||
|
|
<script language="Javascript" src="../rzahg/synch.js" type="text/javascript">
|
||
|
|
</script>
|
||
|
|
|
||
|
|
<h2>Set Profile Handle (QWTSETP, QsySetToProfileHandle) API</h2>
|
||
|
|
|
||
|
|
<div class="box" style="width: 60%;">
|
||
|
|
<br>
|
||
|
|
Required Parameter for QWTSETP:<br>
|
||
|
|
<!-- iddvc RMBR -->
|
||
|
|
<br>
|
||
|
|
<table width="100%">
|
||
|
|
|
||
|
|
<tr>
|
||
|
|
<td align="center" valign="top" width="10%">1</td>
|
||
|
|
<td align="left" valign="top" width="50%">Profile handle</td>
|
||
|
|
<td align="left" valign="top" width="20%">Input</td>
|
||
|
|
<td align="left" valign="top" width="20%">Char(12)</td>
|
||
|
|
</tr>
|
||
|
|
</table>
|
||
|
|
|
||
|
|
<br>
|
||
|
|
Optional Parameter for QWTSETP:<br>
|
||
|
|
<!-- iddvc RMBR -->
|
||
|
|
<br>
|
||
|
|
<table width="100%">
|
||
|
|
|
||
|
|
<tr>
|
||
|
|
<td align="center" valign="top" width="10%">2</td>
|
||
|
|
<td align="left" valign="top" width="50%">Error code</td>
|
||
|
|
<td align="left" valign="top" width="20%">I/O</td>
|
||
|
|
<td align="left" valign="top" width="20%">Char(*)</td>
|
||
|
|
</tr>
|
||
|
|
</table>
|
||
|
|
|
||
|
|
<br>
|
||
|
|
Default Public Authority: *USE<br>
|
||
|
|
<!-- iddvc RMBR -->
|
||
|
|
<br>
|
||
|
|
Threadsafe: Conditional; see <a href="#usage_notes">Usage Notes</a>.<br>
|
||
|
|
<!-- iddvc RMBR -->
|
||
|
|
<br>
|
||
|
|
</div>
|
||
|
|
<br>
|
||
|
|
|
||
|
|
|
||
|
|
<div class="box" style="width: 60%;">
|
||
|
|
<br>
|
||
|
|
Syntax for QsySetToProfileHandle:<br>
|
||
|
|
<pre>
|
||
|
|
#include <qsyphandle.h>
|
||
|
|
|
||
|
|
void QsySetToProfileHandle
|
||
|
|
(unsigned char *<em>Profile_handle</em>,
|
||
|
|
void *<em>Error_code</em>);
|
||
|
|
|
||
|
|
</pre>
|
||
|
|
Service Program: QSYPHANDLE<br>
|
||
|
|
<!-- iddvc RMBR -->
|
||
|
|
<br>
|
||
|
|
Default Public Authority: *USE<br>
|
||
|
|
<!-- iddvc RMBR -->
|
||
|
|
<br>
|
||
|
|
Threadsafe: Conditional; see <a href="#usage_notes">Usage Notes</a>.<br>
|
||
|
|
<!-- iddvc RMBR -->
|
||
|
|
<br>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
<p>The Set Profile Handle (OPM, QWTSETP; ILE, QsySetToProfileHandle) API validates the profile handle,
|
||
|
|
locks the user profile, and changes the current thread to run under the
|
||
|
|
user and group profiles represented by the profile handle. Once the change
|
||
|
|
has been made, any open files and objects allocated by the original
|
||
|
|
profile are accessible to the new profile.</p>
|
||
|
|
|
||
|
|
<p>No other attributes associated with the user or group profile are
|
||
|
|
replaced. The qualified job name does not change to reflect the new user
|
||
|
|
profile. However, any object created by the thread while running under the
|
||
|
|
new profile is owned by the new profile or its group profile. If the job
|
||
|
|
is running single threaded and the job user identity has not been
|
||
|
|
explicitly set by an API, the job user identity is changed to the name of
|
||
|
|
the new profile. If the job is running multithreaded, the job user
|
||
|
|
identity does not change.</p>
|
||
|
|
|
||
|
|
<p>If the profile handle is not valid, the Set Profile Handle API, adds an
|
||
|
|
exception to the job log, and enters a security violation in the QAUDJRN
|
||
|
|
audit journal.</p>
|
||
|
|
|
||
|
|
<p>If you use this API to begin running under a specific profile, any
|
||
|
|
spooled files created are, by default, owned by that profile. This is
|
||
|
|
controlled by the spool file owner (SPLFOWN) parameter on the CRTPRTF
|
||
|
|
command and is done by putting the file under a QPRTJOB job. Any spooled
|
||
|
|
file command that references the spooled file with the job special value *
|
||
|
|
will only access those files that were created before the profiles were
|
||
|
|
swapped.</p>
|
||
|
|
|
||
|
|
<p>A QPRTJOB job is the name of a job that files are spooled under when
|
||
|
|
the current job's user name is not the same as the user profile currently
|
||
|
|
running. For example, if you use Set Profile Handle to set the profile to
|
||
|
|
user JOE and create a spooled file, the file is spooled under job
|
||
|
|
nnnnnn/JOE/QPRTJOB. This ensures that user JOE owns the spooled file and
|
||
|
|
if that user uses the WRKSPLF command, the file is displayed.</p>
|
||
|
|
|
||
|
|
<br>
|
||
|
|
|
||
|
|
|
||
|
|
<h3>Output Queue Considerations</h3>
|
||
|
|
|
||
|
|
<p>The output queue a spooled file is placed in may be different after
|
||
|
|
using this API. If the application using this API produces spooled output
|
||
|
|
that needs to be on a secure output queue or the application is expecting
|
||
|
|
the spooled output to be found on a particular output queue, configuration changes may be required.
|
||
|
|
See the <a href="../rzahg/rzahgprint.htm">Printing</a> topic for
|
||
|
|
information about which output queue contains the
|
||
|
|
spooled output. </p>
|
||
|
|
|
||
|
|
<br>
|
||
|
|
|
||
|
|
|
||
|
|
<!-- Please NOTE: DO NOT DELETE THIS SECTION if this API has no authorities and locks. -->
|
||
|
|
<!-- Instead, use the commented out coding below to indicate NONE. -->
|
||
|
|
<h3>Authorities and Locks</h3>
|
||
|
|
|
||
|
|
<!-- Use this if there are no authorities and locks. -->
|
||
|
|
<p>None.</p>
|
||
|
|
|
||
|
|
<br>
|
||
|
|
<h3>Required Parameter</h3>
|
||
|
|
|
||
|
|
<dl>
|
||
|
|
<dt><strong>Profile handle</strong></dt>
|
||
|
|
|
||
|
|
<dd>INPUT; CHAR(12)
|
||
|
|
|
||
|
|
<p>The profile handle returned by the QSYGETPH API or QsyGetProfileHandle
|
||
|
|
API for the user profile to switch the thread to.</p>
|
||
|
|
</dd>
|
||
|
|
</dl>
|
||
|
|
|
||
|
|
<br>
|
||
|
|
|
||
|
|
<h3>Optional Parameter</h3>
|
||
|
|
|
||
|
|
<dl>
|
||
|
|
<dt><strong>Error code</strong></dt>
|
||
|
|
|
||
|
|
<dd>I/O; CHAR(*)
|
||
|
|
|
||
|
|
<p>The structure in which to return error information. For the format of
|
||
|
|
the structure, see <a href="../apiref/error.htm#hdrerrcod">Error Code Parameter</a>.
|
||
|
|
This parameter is optional for the QWTSETP API and is omissable for the
|
||
|
|
QsySetToProfileHandle API.</p>
|
||
|
|
</dd>
|
||
|
|
</dl>
|
||
|
|
|
||
|
|
<br>
|
||
|
|
|
||
|
|
<h3><a name="usage_notes">Considerations for Scope and Thread
|
||
|
|
Safety</a></h3>
|
||
|
|
|
||
|
|
<p>This API sets the user profile for the thread in which it is called.
|
||
|
|
Thus if the API is called while running multithreaded, it will result in
|
||
|
|
different threads in the same process simultaneously running under
|
||
|
|
different user profiles.</p>
|
||
|
|
|
||
|
|
<p>While this API itself is threadsafe, it should only be used in a job
|
||
|
|
that is running multithreaded when all code running in the job is known to
|
||
|
|
be trusted and operating in a coordinated manner. Some considerations when
|
||
|
|
running multiple threads under different user profiles are:</p>
|
||
|
|
|
||
|
|
<ul>
|
||
|
|
<li>The design of threads is for every thread in the job to share the same
|
||
|
|
resources. With threads, programs share the same static and heap storage,
|
||
|
|
and by passing pointers, they can get at each other's automatic storage.
|
||
|
|
They also share open files and other resources, such as the same QTEMP
|
||
|
|
library and the profile handles used by the Set Profile Handle API.</li>
|
||
|
|
|
||
|
|
<li>Assume two users are allowed to run their own commands or programs in
|
||
|
|
different threads of a single job. One of the users may be able to read or
|
||
|
|
write data of the other user. This access may occur without the system
|
||
|
|
doing an authority check or even auditing the fact that they read or
|
||
|
|
modified that data.</li>
|
||
|
|
</ul>
|
||
|
|
|
||
|
|
<br>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<h3>Error Messages</h3>
|
||
|
|
|
||
|
|
<table width="100%" cellpadding="5">
|
||
|
|
<!-- cols="15 85" -->
|
||
|
|
<tr>
|
||
|
|
<th align="left" valign="top">Message ID</th>
|
||
|
|
<th align="left" valign="top">Error Message Text</th>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr>
|
||
|
|
<td align="left" valign="top">CPF22AD E</td>
|
||
|
|
<td align="left" valign="top">Group profile for user not found.</td>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr>
|
||
|
|
<td align="left" valign="top">CPF22E7 E</td>
|
||
|
|
<td align="left" valign="top">Profile handle is not valid.</td>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr>
|
||
|
|
<td align="left" valign="top">CPF2204 E</td>
|
||
|
|
<td align="left" valign="top">User profile &1 not found.</td>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr>
|
||
|
|
<td align="left" valign="top">CPF2213 E</td>
|
||
|
|
<td align="left" valign="top">Not able to allocate user profile &1.</td>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr>
|
||
|
|
<td align="left" valign="top">CPF2217 E</td>
|
||
|
|
<td align="left" valign="top">Not authorized to user profile &1.</td>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr>
|
||
|
|
<td align="left" valign="top">CPF2225 E</td>
|
||
|
|
<td align="left" valign="top">Not able to allocate internal system object.</td>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr>
|
||
|
|
<td align="left" valign="top">CPF3C90 E</td>
|
||
|
|
<td align="left" valign="top">Literal value cannot be changed.</td>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr>
|
||
|
|
<td align="left" valign="top">CPF3CF1 E</td>
|
||
|
|
<td align="left" valign="top">Error code parameter not valid.</td>
|
||
|
|
</tr>
|
||
|
|
|
||
|
|
<tr>
|
||
|
|
<td align="left" valign="top">CPF9872 E</td>
|
||
|
|
<td align="left" valign="top">Program or service program &1 in library &2
|
||
|
|
ended. Reason code &3.</td>
|
||
|
|
</tr>
|
||
|
|
</table>
|
||
|
|
<br>
|
||
|
|
<hr>
|
||
|
|
API introduced: V2R1
|
||
|
|
|
||
|
|
<hr>
|
||
|
|
<center>
|
||
|
|
<table cellpadding="2" cellspacing="2">
|
||
|
|
<tr align="center">
|
||
|
|
<td valign="middle" align="center"><a href="#Top_Of_Page">Top</a> | <a href=
|
||
|
|
"sec.htm">Security APIs</a> | <a href="aplist.htm">APIs by category</a></td>
|
||
|
|
</tr>
|
||
|
|
</table>
|
||
|
|
</center>
|
||
|
|
</body>
|
||
|
|
</html>
|
||
|
|
|